dissect.target 3.18.dev1__py3-none-any.whl → 3.18.dev2__py3-none-any.whl
Sign up to get free protection for your applications and to get access to all the features.
- dissect/target/plugins/apps/av/mcafee.py +3 -0
- dissect/target/plugins/apps/av/sophos.py +6 -0
- dissect/target/plugins/apps/av/symantec.py +6 -0
- dissect/target/plugins/apps/av/trendmicro.py +6 -0
- dissect/target/plugins/apps/browser/chromium.py +12 -0
- dissect/target/plugins/apps/browser/firefox.py +13 -1
- dissect/target/plugins/apps/browser/iexplore.py +6 -0
- dissect/target/plugins/os/unix/linux/cmdline.py +3 -0
- dissect/target/plugins/os/unix/linux/environ.py +3 -0
- dissect/target/plugins/os/unix/linux/processes.py +3 -0
- dissect/target/plugins/os/unix/linux/sockets.py +15 -0
- dissect/target/plugins/os/unix/log/atop.py +3 -0
- dissect/target/plugins/os/windows/activitiescache.py +3 -0
- dissect/target/plugins/os/windows/catroot.py +6 -0
- dissect/target/plugins/os/windows/lnk.py +3 -0
- dissect/target/plugins/os/windows/log/etl.py +9 -0
- dissect/target/plugins/os/windows/log/evt.py +3 -0
- dissect/target/plugins/os/windows/log/evtx.py +3 -0
- dissect/target/plugins/os/windows/log/pfro.py +3 -0
- dissect/target/plugins/os/windows/log/schedlgu.py +5 -2
- dissect/target/plugins/os/windows/prefetch.py +6 -0
- dissect/target/plugins/os/windows/recyclebin.py +3 -0
- dissect/target/plugins/os/windows/regf/appxdebugkeys.py +3 -0
- dissect/target/plugins/os/windows/regf/bam.py +3 -0
- dissect/target/plugins/os/windows/regf/clsid.py +3 -0
- dissect/target/plugins/os/windows/regf/firewall.py +3 -0
- dissect/target/plugins/os/windows/regf/muicache.py +3 -0
- dissect/target/plugins/os/windows/regf/recentfilecache.py +3 -0
- dissect/target/plugins/os/windows/regf/regf.py +6 -0
- dissect/target/plugins/os/windows/regf/runkeys.py +3 -0
- dissect/target/plugins/os/windows/regf/shimcache.py +3 -0
- dissect/target/plugins/os/windows/regf/trusteddocs.py +3 -0
- dissect/target/plugins/os/windows/regf/usb.py +3 -0
- dissect/target/plugins/os/windows/regf/userassist.py +3 -0
- dissect/target/plugins/os/windows/sam.py +3 -0
- dissect/target/plugins/os/windows/services.py +3 -0
- dissect/target/plugins/os/windows/wer.py +3 -0
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/METADATA +1 -1
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/RECORD +44 -44
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/COPYRIGHT +0 -0
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/LICENSE +0 -0
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/WHEEL +0 -0
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/entry_points.txt +0 -0
- {dissect.target-3.18.dev1.dist-info → dissect.target-3.18.dev2.dist-info}/top_level.txt +0 -0
@@ -71,6 +71,9 @@ class McAfeePlugin(Plugin):
|
|
71
71
|
"""Return msc log history records from McAfee.
|
72
72
|
|
73
73
|
Yields McAfeeMscLogRecord with the following fields:
|
74
|
+
|
75
|
+
.. code-block:: text
|
76
|
+
|
74
77
|
hostname (string): The target hostname.
|
75
78
|
domain (string): The target domain.
|
76
79
|
ts (datetime): timestamp.
|
@@ -56,6 +56,9 @@ class SophosPlugin(Plugin):
|
|
56
56
|
"""Return alert log records from Sophos Hitman Pro/Alert.
|
57
57
|
|
58
58
|
Yields HitmanAlertRecord with the following fields:
|
59
|
+
|
60
|
+
.. code-block:: text
|
61
|
+
|
59
62
|
ts (datetime): Timestamp.
|
60
63
|
alert (string): Type of Alert.
|
61
64
|
description (string): Short description of the alert.
|
@@ -85,6 +88,9 @@ class SophosPlugin(Plugin):
|
|
85
88
|
"""Return log history records from Sophos Home.
|
86
89
|
|
87
90
|
Yields SophosLogRecord with the following fields:
|
91
|
+
|
92
|
+
.. code-block:: text
|
93
|
+
|
88
94
|
ts (datetime): Timestamp.
|
89
95
|
description (string): Short description of the alert.
|
90
96
|
path (path): Path to the infected file (if available).
|
@@ -293,6 +293,9 @@ class SymantecPlugin(Plugin):
|
|
293
293
|
"""Return log records.
|
294
294
|
|
295
295
|
Yields SEPLogRecord with the following fields:
|
296
|
+
|
297
|
+
.. code-block:: text
|
298
|
+
|
296
299
|
ts (datetime): Timestamp associated with the event.
|
297
300
|
virus (string): Name of the virus.
|
298
301
|
user (string): Name of the user associated with the event.
|
@@ -326,6 +329,9 @@ class SymantecPlugin(Plugin):
|
|
326
329
|
"""Return log firewall records.
|
327
330
|
|
328
331
|
Yields SEPFirewallRecord with the following fields:
|
332
|
+
|
333
|
+
.. code-block:: text
|
334
|
+
|
329
335
|
ts (datetime): Timestamp associated with the event.
|
330
336
|
protocol (string): Protocol name associated with the firewall record.
|
331
337
|
local_ip ("net.ipaddress"): Local IP address associated with the event.
|
@@ -71,6 +71,9 @@ class TrendMicroPlugin(Plugin):
|
|
71
71
|
"""Return Trend Micro Worry-free log history records.
|
72
72
|
|
73
73
|
Yields TrendMicroWFLogRecord with the following fields:
|
74
|
+
|
75
|
+
.. code-block:: text
|
76
|
+
|
74
77
|
hostname (string): The target hostname.
|
75
78
|
domain (string): The target domain.
|
76
79
|
ts (datetime): timestamp.
|
@@ -94,6 +97,9 @@ class TrendMicroPlugin(Plugin):
|
|
94
97
|
"""Return Trend Micro Worry-free firewall log history records.
|
95
98
|
|
96
99
|
Yields TrendMicroWFFirewallRecord with the following fields:
|
100
|
+
|
101
|
+
.. code-block:: text
|
102
|
+
|
97
103
|
hostname (string): The target hostname.
|
98
104
|
domain (string): The target domain.
|
99
105
|
ts (datetime): timestamp.
|
@@ -148,6 +148,9 @@ class ChromiumMixin:
|
|
148
148
|
browser_name: The name of the browser as a string.
|
149
149
|
|
150
150
|
Yields:
|
151
|
+
|
152
|
+
.. code-block:: text
|
153
|
+
|
151
154
|
Records with the following fields:
|
152
155
|
ts (datetime): Visit timestamp.
|
153
156
|
browser (string): The browser from which the records are generated from.
|
@@ -209,6 +212,9 @@ class ChromiumMixin:
|
|
209
212
|
browser_name: The name of the browser as a string.
|
210
213
|
|
211
214
|
Yields:
|
215
|
+
|
216
|
+
.. code-block:: text
|
217
|
+
|
212
218
|
Records with the following fields:
|
213
219
|
ts_created (datetime): Cookie created timestamp.
|
214
220
|
ts_last_accessed (datetime): Cookie last accessed timestamp.
|
@@ -284,6 +290,9 @@ class ChromiumMixin:
|
|
284
290
|
browser_name: The name of the browser as a string.
|
285
291
|
|
286
292
|
Yields:
|
293
|
+
|
294
|
+
.. code-block:: text
|
295
|
+
|
287
296
|
Records with the following fields:
|
288
297
|
ts_start (datetime): Download start timestamp.
|
289
298
|
ts_end (datetime): Download end timestamp.
|
@@ -344,6 +353,9 @@ class ChromiumMixin:
|
|
344
353
|
browser_name (str): Name of the browser to scan for extensions.
|
345
354
|
|
346
355
|
Yields:
|
356
|
+
|
357
|
+
.. code-block:: text
|
358
|
+
|
347
359
|
Records with the following fields:
|
348
360
|
ts_install (datetime): Extension install timestamp.
|
349
361
|
ts_update (datetime): Extension update timestamp.
|
@@ -132,6 +132,9 @@ class FirefoxPlugin(BrowserPlugin):
|
|
132
132
|
"""Return browser history records from Firefox.
|
133
133
|
|
134
134
|
Yields BrowserHistoryRecord with the following fields:
|
135
|
+
|
136
|
+
.. code-block:: text
|
137
|
+
|
135
138
|
ts (datetime): Visit timestamp.
|
136
139
|
browser (string): The browser from which the records are generated from.
|
137
140
|
id (string): Record ID.
|
@@ -193,6 +196,9 @@ class FirefoxPlugin(BrowserPlugin):
|
|
193
196
|
browser_name: The name of the browser as a string.
|
194
197
|
|
195
198
|
Yields:
|
199
|
+
|
200
|
+
.. code-block:: text
|
201
|
+
|
196
202
|
Records with the following fields:
|
197
203
|
ts_created (datetime): Cookie created timestamp.
|
198
204
|
ts_last_accessed (datetime): Cookie last accessed timestamp.
|
@@ -232,6 +238,9 @@ class FirefoxPlugin(BrowserPlugin):
|
|
232
238
|
"""Return browser download records from Firefox.
|
233
239
|
|
234
240
|
Yields BrowserDownloadRecord with the following fields:
|
241
|
+
|
242
|
+
.. code-block:: text
|
243
|
+
|
235
244
|
ts_start (datetime): Download start timestamp.
|
236
245
|
ts_end (datetime): Download end timestamp.
|
237
246
|
browser (string): The browser from which the records are generated from.
|
@@ -315,7 +324,10 @@ class FirefoxPlugin(BrowserPlugin):
|
|
315
324
|
def extensions(self) -> Iterator[BrowserExtensionRecord]:
|
316
325
|
"""Return browser extension records for Firefox.
|
317
326
|
|
318
|
-
Yields BrowserExtensionRecord with the following fields
|
327
|
+
Yields BrowserExtensionRecord with the following fields:
|
328
|
+
|
329
|
+
.. code-block:: text
|
330
|
+
|
319
331
|
ts_install (datetime): Extension install timestamp.
|
320
332
|
ts_update (datetime): Extension update timestamp.
|
321
333
|
browser (string): The browser from which the records are generated.
|
@@ -131,6 +131,9 @@ class InternetExplorerPlugin(BrowserPlugin):
|
|
131
131
|
"""Return browser history records from Internet Explorer.
|
132
132
|
|
133
133
|
Yields BrowserHistoryRecord with the following fields:
|
134
|
+
|
135
|
+
.. code-block:: text
|
136
|
+
|
134
137
|
ts (datetime): Visit timestamp.
|
135
138
|
browser (string): The browser from which the records are generated from.
|
136
139
|
id (string): Record ID.
|
@@ -183,6 +186,9 @@ class InternetExplorerPlugin(BrowserPlugin):
|
|
183
186
|
"""Return browser downloads records from Internet Explorer.
|
184
187
|
|
185
188
|
Yields BrowserDownloadRecord with the following fields:
|
189
|
+
|
190
|
+
.. code-block:: text
|
191
|
+
|
186
192
|
ts_start (datetime): Download start timestamp.
|
187
193
|
ts_end (datetime): Download end timestamp.
|
188
194
|
browser (string): The browser from which the records are generated from.
|
@@ -29,6 +29,9 @@ class CmdlinePlugin(Plugin):
|
|
29
29
|
Think of this output as the command line that the process wants you to see.
|
30
30
|
|
31
31
|
Yields CmdlineRecord with the following fields:
|
32
|
+
|
33
|
+
.. code-block:: text
|
34
|
+
|
32
35
|
hostname (string): The target hostname.
|
33
36
|
domain (string): The target domain.
|
34
37
|
ts (datetime): The starttime of the process.
|
@@ -27,6 +27,9 @@ class EnvironPlugin(Plugin):
|
|
27
27
|
the environ(7) variable directly), this plugin will not reflect those changes.
|
28
28
|
|
29
29
|
Yields EnvironmentVariableRecord with the following fields:
|
30
|
+
|
31
|
+
.. code-block:: text
|
32
|
+
|
30
33
|
hostname (string): The target hostname.
|
31
34
|
domain (string): The target domain.
|
32
35
|
ts (datetime): The modification timestamp of the processes' environ file.
|
@@ -29,6 +29,9 @@ class ProcProcesses(Plugin):
|
|
29
29
|
Each ``/proc/[pid]`` subdirectory contains various pseudo-files.
|
30
30
|
|
31
31
|
Yields ProcProcessRecord with the following fields:
|
32
|
+
|
33
|
+
.. code-block:: text
|
34
|
+
|
32
35
|
hostname (string): The target hostname.
|
33
36
|
domain (string): The target domain.
|
34
37
|
ts (datetime): The start time of the process.
|
@@ -78,6 +78,9 @@ class NetSocketPlugin(Plugin):
|
|
78
78
|
"""This plugin yields the packet sockets and available stats associated with them.
|
79
79
|
|
80
80
|
Yields PacketSocketRecord with the following fields:
|
81
|
+
|
82
|
+
.. code-block:: text
|
83
|
+
|
81
84
|
hostname (string): The target hostname.
|
82
85
|
domain (string): The target domain.
|
83
86
|
protocol (int): The captured protocol i.e. 0003 is ETH_P_ALL
|
@@ -101,6 +104,9 @@ class NetSocketPlugin(Plugin):
|
|
101
104
|
"""This plugin yields the unix sockets and available stats associated with them.
|
102
105
|
|
103
106
|
Yields UnixSocketRecord with the following fields:
|
107
|
+
|
108
|
+
.. code-block:: text
|
109
|
+
|
104
110
|
hostname (string): The target hostname.
|
105
111
|
domain (string): The target domain.
|
106
112
|
protocol (string): The protocol used by the socket.
|
@@ -117,6 +123,9 @@ class NetSocketPlugin(Plugin):
|
|
117
123
|
"""This plugin yields the raw and raw6 sockets and available stats associated with them.
|
118
124
|
|
119
125
|
Yields NetSocketRecord with the following fields:
|
126
|
+
|
127
|
+
.. code-block:: text
|
128
|
+
|
120
129
|
hostname (string): The target hostname.
|
121
130
|
domain (string): The target domain.
|
122
131
|
protocol (string): The protocol used by the socket.
|
@@ -140,6 +149,9 @@ class NetSocketPlugin(Plugin):
|
|
140
149
|
"""This plugin yields the udp and udp6 sockets and available stats associated with them.
|
141
150
|
|
142
151
|
Yields NetSocketRecord with the following fields:
|
152
|
+
|
153
|
+
.. code-block:: text
|
154
|
+
|
143
155
|
hostname (string): The target hostname.
|
144
156
|
domain (string): The target domain.
|
145
157
|
protocol (string): The protocol used by the socket.
|
@@ -163,6 +175,9 @@ class NetSocketPlugin(Plugin):
|
|
163
175
|
"""This plugin yields the tcp and tcp6 sockets and available stats associated with them.
|
164
176
|
|
165
177
|
Yields NetSocketRecord with the following fields:
|
178
|
+
|
179
|
+
.. code-block:: text
|
180
|
+
|
166
181
|
hostname (string): The target hostname.
|
167
182
|
domain (string): The target domain.
|
168
183
|
protocol (string): The protocol used by the socket.
|
@@ -270,6 +270,9 @@ class AtopPlugin(Plugin):
|
|
270
270
|
- https://diablohorn.com/2022/11/17/parsing-atop-files-with-python-dissect-cstruct/
|
271
271
|
|
272
272
|
Yields AtopRecord with fields:
|
273
|
+
|
274
|
+
.. code-block:: text
|
275
|
+
|
273
276
|
hostname (string): The target hostname.
|
274
277
|
process (string): The process name.
|
275
278
|
cmdline (string): The command-line of the process.
|
@@ -77,6 +77,9 @@ class ActivitiesCachePlugin(Plugin):
|
|
77
77
|
- https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/
|
78
78
|
|
79
79
|
Yields ActivitiesCacheRecords with the following fields:
|
80
|
+
|
81
|
+
.. code-block:: text
|
82
|
+
|
80
83
|
hostname (string): The target hostname.
|
81
84
|
domain (string): The target domain.
|
82
85
|
start_time (datetime): StartTime field.
|
@@ -105,6 +105,9 @@ class CatrootPlugin(Plugin):
|
|
105
105
|
- https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
|
106
106
|
|
107
107
|
Yields CatrootRecords with the following fields:
|
108
|
+
|
109
|
+
.. code-block:: text
|
110
|
+
|
108
111
|
hostname (string): The target hostname.
|
109
112
|
domain (string): The target domain.
|
110
113
|
digest (digest): The parsed digest.
|
@@ -210,6 +213,9 @@ class CatrootPlugin(Plugin):
|
|
210
213
|
- https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
|
211
214
|
|
212
215
|
Yields CatrootRecords with the following fields:
|
216
|
+
|
217
|
+
.. code-block:: text
|
218
|
+
|
213
219
|
hostname (string): The target hostname.
|
214
220
|
domain (string): The target domain.
|
215
221
|
digest (digest): The parsed digest.
|
@@ -51,6 +51,9 @@ class LnkPlugin(Plugin):
|
|
51
51
|
"""Parse all .lnk files in /ProgramData, /Users, and /Windows or from a specified path in record format.
|
52
52
|
|
53
53
|
Yields a LnkRecord record with the following fields:
|
54
|
+
|
55
|
+
.. code-block:: text
|
56
|
+
|
54
57
|
lnk_path (path): Path of the link (.lnk) file.
|
55
58
|
lnk_name (string): Name of the link (.lnk) file.
|
56
59
|
lnk_mtime (datetime): Modification time of the link (.lnk) file.
|
@@ -122,6 +122,9 @@ class EtlPlugin(Plugin):
|
|
122
122
|
|
123
123
|
Yields dynamically created records based on the fields inside an ETL event.
|
124
124
|
At least contains the following fields:
|
125
|
+
|
126
|
+
.. code-block:: text
|
127
|
+
|
125
128
|
hostname (string): The target hostname.
|
126
129
|
domain (string): The target domain.
|
127
130
|
ts (datetime): The TimeCreated_SystemTime field of the event.
|
@@ -140,6 +143,9 @@ class EtlPlugin(Plugin):
|
|
140
143
|
|
141
144
|
Yields dynamically created records based on the fields inside an ETL event.
|
142
145
|
At least contains the following fields:
|
146
|
+
|
147
|
+
.. code-block:: text
|
148
|
+
|
143
149
|
hostname (string): The target hostname.
|
144
150
|
domain (string): The target domain.
|
145
151
|
ts (datetime): The TimeCreated_SystemTime field of the event.
|
@@ -157,6 +163,9 @@ class EtlPlugin(Plugin):
|
|
157
163
|
|
158
164
|
Yields dynamically created records based on the fields inside an ETL event.
|
159
165
|
At least contains the following fields:
|
166
|
+
|
167
|
+
.. code-block:: text
|
168
|
+
|
160
169
|
hostname (string): The target hostname.
|
161
170
|
domain (string): The target domain.
|
162
171
|
ts (datetime): The TimeCreated_SystemTime field of the event.
|
@@ -125,6 +125,9 @@ class EvtPlugin(WindowsEventlogsMixin, plugin.Plugin):
|
|
125
125
|
|
126
126
|
Yields dynamically created records based on the fields in the event.
|
127
127
|
At least contains the following fields:
|
128
|
+
|
129
|
+
.. code-block:: text
|
130
|
+
|
128
131
|
hostname (string): The target hostname.
|
129
132
|
domain (string): The target domain.
|
130
133
|
ts (datetime): The TimeCreated_SystemTime field of the event.
|
@@ -47,6 +47,9 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
|
|
47
47
|
|
48
48
|
Yields dynamically created records based on the fields in the event.
|
49
49
|
At least contains the following fields:
|
50
|
+
|
51
|
+
.. code-block:: text
|
52
|
+
|
50
53
|
hostname (string): The target hostname.
|
51
54
|
domain (string): The target domain.
|
52
55
|
ts (datetime): The TimeCreated_SystemTime field of the event.
|
@@ -41,6 +41,9 @@ class PfroPlugin(Plugin):
|
|
41
41
|
- https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/
|
42
42
|
|
43
43
|
Yields PfroRecords with fields:
|
44
|
+
|
45
|
+
.. code-block:: text
|
46
|
+
|
44
47
|
hostname (string): The target hostname.
|
45
48
|
domain (string): The target domain.
|
46
49
|
ts (datetime): The parsed timestamp.
|
@@ -129,9 +129,12 @@ class SchedLgUPlugin(Plugin):
|
|
129
129
|
|
130
130
|
Adversaries may use malicious ``.job`` files to gain persistence on a system.
|
131
131
|
|
132
|
-
|
132
|
+
Yields SchedLgURecord with fields:
|
133
|
+
|
134
|
+
.. code-block:: text
|
135
|
+
|
133
136
|
ts (datetime): The timestamp of the event.
|
134
|
-
job (str): The name of the
|
137
|
+
job (str): The name of the .job file.
|
135
138
|
command (str): The command executed.
|
136
139
|
status (str): The status of the event (finished, completed, exited, stopped).
|
137
140
|
exit_code (int): The exit code of the event.
|
@@ -258,6 +258,9 @@ class PrefetchPlugin(Plugin):
|
|
258
258
|
- https://www.geeksforgeeks.org/prefetch-files-in-windows/
|
259
259
|
|
260
260
|
Yields PrefetchRecords with fields:
|
261
|
+
|
262
|
+
.. code-block:: text
|
263
|
+
|
261
264
|
hostname (string): The target hostname.
|
262
265
|
domain (string): The target domain.
|
263
266
|
ts (datetime): Run timestamp.
|
@@ -269,6 +272,9 @@ class PrefetchPlugin(Plugin):
|
|
269
272
|
with --grouped:
|
270
273
|
|
271
274
|
Yields PrefetchRecords with fields:
|
275
|
+
|
276
|
+
.. code-block:: text
|
277
|
+
|
272
278
|
hostname (string): The target hostname.
|
273
279
|
domain (string): The target domain.
|
274
280
|
ts (datetime): Run timestamp.
|
@@ -66,6 +66,9 @@ class RecyclebinPlugin(Plugin):
|
|
66
66
|
Return files located in the recycle bin ($Recycle.Bin).
|
67
67
|
|
68
68
|
Yields RecycleBinRecords with fields:
|
69
|
+
|
70
|
+
.. code-block:: text
|
71
|
+
|
69
72
|
hostname (string): The target hostname
|
70
73
|
domain (string): The target domain
|
71
74
|
ts (datetime): The time of deletion
|
@@ -86,6 +86,9 @@ class AppxDebugKeysPlugin(Plugin):
|
|
86
86
|
- https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
|
87
87
|
|
88
88
|
Yields AppXDebugKeyRecords with fields:
|
89
|
+
|
90
|
+
.. code-block:: text
|
91
|
+
|
89
92
|
hostname (string): The target hostname.
|
90
93
|
domain (string): The target domain.
|
91
94
|
ts (datetime): The registry key last modified timestamp.
|
@@ -41,6 +41,9 @@ class BamDamPlugin(Plugin):
|
|
41
41
|
"""Parse bam and dam registry keys.
|
42
42
|
|
43
43
|
Yields BamDamRecords with fields:
|
44
|
+
|
45
|
+
.. code-block:: text
|
46
|
+
|
44
47
|
hostname (string): The target hostname.
|
45
48
|
domain (string): The target domain.
|
46
49
|
ts (datetime): The parsed timestamp.
|
@@ -55,6 +55,9 @@ class CLSIDPlugin(Plugin):
|
|
55
55
|
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID.
|
56
56
|
|
57
57
|
Yields CLSIDRecords with fields:
|
58
|
+
|
59
|
+
.. code-block:: text
|
60
|
+
|
58
61
|
hostname (string): The target hostname.
|
59
62
|
domain (string): The target domain.
|
60
63
|
ts (datetime): Last modified timestamp of the registry key.
|
@@ -26,6 +26,9 @@ class FirewallPlugin(Plugin):
|
|
26
26
|
HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules registry key.
|
27
27
|
|
28
28
|
Yields dynamic records with usually the following fields:
|
29
|
+
|
30
|
+
.. code-block:: text
|
31
|
+
|
29
32
|
hostname (string): The target hostname.
|
30
33
|
domain (string): The target domain.
|
31
34
|
key (string): The rule key name.
|
@@ -48,6 +48,9 @@ class MuiCachePlugin(Plugin):
|
|
48
48
|
- https://forensafe.com/blogs/muicache.html
|
49
49
|
|
50
50
|
Yields MuiCacheRecords with fields:
|
51
|
+
|
52
|
+
.. code-block:: text
|
53
|
+
|
51
54
|
hostname (string): The target hostname.
|
52
55
|
domain (string): The target domain.
|
53
56
|
index (varint): The index of the entry.
|
@@ -45,6 +45,9 @@ class RecentFileCachePlugin(Plugin):
|
|
45
45
|
"""Parse RecentFileCache.bcf.
|
46
46
|
|
47
47
|
Yields RecentFileCacheRecords with fields:
|
48
|
+
|
49
|
+
.. code-block:: text
|
50
|
+
|
48
51
|
hostname (string): The target hostname.
|
49
52
|
domain (string): The target domain.
|
50
53
|
path (uri): The parsed path.
|
@@ -49,6 +49,9 @@ class RegfPlugin(Plugin):
|
|
49
49
|
Yields RegistryKeyRecords and RegistryValueRecords
|
50
50
|
|
51
51
|
RegistryKeyRecord fields:
|
52
|
+
|
53
|
+
.. code-block:: text
|
54
|
+
|
52
55
|
hostname (string): The target hostname.
|
53
56
|
domain (string): The target domain.
|
54
57
|
ts (datetime): The registry key last modified time.
|
@@ -57,6 +60,9 @@ class RegfPlugin(Plugin):
|
|
57
60
|
source (string): The hive file path.
|
58
61
|
|
59
62
|
RegistryValueRecord fields:
|
63
|
+
|
64
|
+
.. code-block:: text
|
65
|
+
|
60
66
|
hostname (string): The target hostname.
|
61
67
|
domain (string): The target domain.
|
62
68
|
ts (datetime): The registry key last modified time.
|
@@ -61,6 +61,9 @@ class RunKeysPlugin(Plugin):
|
|
61
61
|
- https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
|
62
62
|
|
63
63
|
Yields RunKeyRecords with fields:
|
64
|
+
|
65
|
+
.. code-block:: text
|
66
|
+
|
64
67
|
hostname (string): The target hostname.
|
65
68
|
domain (string): The target domain.
|
66
69
|
ts (datetime): The registry key last modified timestamp.
|
@@ -318,6 +318,9 @@ class ShimcachePlugin(Plugin):
|
|
318
318
|
- https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
|
319
319
|
|
320
320
|
Yields ShimcacheRecords with the following fields:
|
321
|
+
|
322
|
+
.. code-block:: text
|
323
|
+
|
321
324
|
hostname (string): The target hostname.
|
322
325
|
domain (string): The target domain.
|
323
326
|
last_modified (datetime): The last modified date.
|
@@ -61,6 +61,9 @@ class TrustedDocumentsPlugin(Plugin):
|
|
61
61
|
|
62
62
|
Yields records based on the values within the TrustRecords registry keys.
|
63
63
|
At least contains the following fields:
|
64
|
+
|
65
|
+
.. code-block:: text
|
66
|
+
|
64
67
|
application (string): Application name of the Office product that produced the TrustRecords registry key.
|
65
68
|
document_path (path): Path to the document for which a TrustRecords entry is created.
|
66
69
|
ts (datetime): The created time of the TrustRecord registry key.
|
@@ -93,6 +93,9 @@ class UsbPlugin(Plugin):
|
|
93
93
|
HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR registry key.
|
94
94
|
|
95
95
|
Yields UsbRegistryRecord with fields:
|
96
|
+
|
97
|
+
.. code-block:: text
|
98
|
+
|
96
99
|
hostname (string): The target hostname
|
97
100
|
domain (string): The target domain
|
98
101
|
type (string): Type of USB device
|
@@ -72,6 +72,9 @@ class UserAssistPlugin(Plugin):
|
|
72
72
|
- https://www.aldeid.com/wiki/Windows-userassist-keys
|
73
73
|
|
74
74
|
Yields UserAssistRecords with fields:
|
75
|
+
|
76
|
+
.. code-block:: text
|
77
|
+
|
75
78
|
hostname (string): The target hostname.
|
76
79
|
domain (string): The target domain.
|
77
80
|
ts (datetime): The entry timestamp.
|
@@ -356,6 +356,9 @@ class SamPlugin(Plugin):
|
|
356
356
|
- https://en.wikipedia.org/wiki/Security_Account_Manager
|
357
357
|
|
358
358
|
Yields SamRecords with fields:
|
359
|
+
|
360
|
+
.. code-block:: text
|
361
|
+
|
359
362
|
rid (uint32): The RID.
|
360
363
|
fullname (string): Parsed fullname.
|
361
364
|
username (string): Parsed username.
|
@@ -72,6 +72,9 @@ class ServicesPlugin(Plugin):
|
|
72
72
|
- https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html
|
73
73
|
|
74
74
|
Yields ServiceRecords with fields:
|
75
|
+
|
76
|
+
.. code-block:: text
|
77
|
+
|
75
78
|
hostname (string): The target hostname.
|
76
79
|
domain (string): The target domain.
|
77
80
|
ts (datatime): The last modified timestamp of the registry key.
|
@@ -155,6 +155,9 @@ class WindowsErrorReportingPlugin(Plugin):
|
|
155
155
|
|
156
156
|
Yields dynamically created records based on the fields in the files. A record at least contains the following
|
157
157
|
fields:
|
158
|
+
|
159
|
+
.. code-block:: text
|
160
|
+
|
158
161
|
ts (datetime): The moment in time when the error event took place.
|
159
162
|
version (string): WER file version.
|
160
163
|
event_type (string): WER file event type.
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Metadata-Version: 2.1
|
2
2
|
Name: dissect.target
|
3
|
-
Version: 3.18.
|
3
|
+
Version: 3.18.dev2
|
4
4
|
Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
6
6
|
License: Affero General Public License v3
|
@@ -114,18 +114,18 @@ dissect/target/loaders/xva.py,sha256=WmqdM9qGrZcChx0PiiTLyMTSatJIy_ItGO9cPMALQSE
|
|
114
114
|
dissect/target/plugins/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
115
115
|
dissect/target/plugins/apps/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
116
116
|
dissect/target/plugins/apps/av/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
117
|
-
dissect/target/plugins/apps/av/mcafee.py,sha256=
|
118
|
-
dissect/target/plugins/apps/av/sophos.py,sha256=
|
119
|
-
dissect/target/plugins/apps/av/symantec.py,sha256=
|
120
|
-
dissect/target/plugins/apps/av/trendmicro.py,sha256=
|
117
|
+
dissect/target/plugins/apps/av/mcafee.py,sha256=YWrsB5kQFtXfhqi6mdMPMVk2qh_KCiOBiaTnbj8mVrM,5440
|
118
|
+
dissect/target/plugins/apps/av/sophos.py,sha256=TuO-ggdD5De0UTouzNF7-1iLULIOvr6FDktocnM0aF0,4164
|
119
|
+
dissect/target/plugins/apps/av/symantec.py,sha256=I1_zZ2ihKptB2JJ7sYZ7df0AgtK3KhWPsbDkc2m_hPA,14171
|
120
|
+
dissect/target/plugins/apps/av/trendmicro.py,sha256=ZhxL4IkzyHfR2xaNIzk-M-v-ITMuLG_yqq_0djqGMjU,4675
|
121
121
|
dissect/target/plugins/apps/browser/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
122
122
|
dissect/target/plugins/apps/browser/brave.py,sha256=EW1ubL10swHeV9CscfpE-SrNZozul_Ewj48LNRaG5Kg,2865
|
123
123
|
dissect/target/plugins/apps/browser/browser.py,sha256=rBIwcgdl73gm-8APwx2jEUAYXRniXkqcdMr2UYj_tS8,4118
|
124
124
|
dissect/target/plugins/apps/browser/chrome.py,sha256=hxS8gqpBwoCrPaxNpllIa6K9DtsSGzn6XXcUaHyes6w,3048
|
125
|
-
dissect/target/plugins/apps/browser/chromium.py,sha256=
|
125
|
+
dissect/target/plugins/apps/browser/chromium.py,sha256=N9hS-a45iEv_GyKhLZQR_FSkEjWlMA0f22eURBuxF5Y,27999
|
126
126
|
dissect/target/plugins/apps/browser/edge.py,sha256=woXzZtHPWmfcV8vbxGKHELKru5JRb32MAXs43_b4K4E,2883
|
127
|
-
dissect/target/plugins/apps/browser/firefox.py,sha256=
|
128
|
-
dissect/target/plugins/apps/browser/iexplore.py,sha256=
|
127
|
+
dissect/target/plugins/apps/browser/firefox.py,sha256=ROrzhI2SV81E63hi5PRtyJveRrBacWNJ9FWZS_ondlk,30929
|
128
|
+
dissect/target/plugins/apps/browser/iexplore.py,sha256=g_xw0toaiyjevxO8g9XPCOqc-CXZp39FVquRhPFGdTE,8801
|
129
129
|
dissect/target/plugins/apps/container/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
130
130
|
dissect/target/plugins/apps/container/docker.py,sha256=67Eih9AfUbqsP-HlnlwoHi4rSAnVCZWM76sEyO_1m18,15316
|
131
131
|
dissect/target/plugins/apps/remoteaccess/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
@@ -211,15 +211,15 @@ dissect/target/plugins/os/unix/esxi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQ
|
|
211
211
|
dissect/target/plugins/os/unix/esxi/_os.py,sha256=8kFFK9986zN8hXmDUWwdQHtbV33nWKerRuisg_xbsoQ,17504
|
212
212
|
dissect/target/plugins/os/unix/linux/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
213
213
|
dissect/target/plugins/os/unix/linux/_os.py,sha256=YJYwuq_iAinOrPqTE49Q4DLYMWBeRCly1uTbDvPhp6Q,2796
|
214
|
-
dissect/target/plugins/os/unix/linux/cmdline.py,sha256=
|
215
|
-
dissect/target/plugins/os/unix/linux/environ.py,sha256=
|
214
|
+
dissect/target/plugins/os/unix/linux/cmdline.py,sha256=AyMfndt3UsmJtoOyZYC8nWq2GZg9oPvn8SiI3M4NxnE,1622
|
215
|
+
dissect/target/plugins/os/unix/linux/environ.py,sha256=UOQD7Xmu754u2oAh3L5g5snuz-gv4jbWbVy46qszYjo,1881
|
216
216
|
dissect/target/plugins/os/unix/linux/iptables.py,sha256=qTzY5PHHXA33WnPYb5NESgoSwI7ECZ8YPoEe_Fmln-8,6045
|
217
217
|
dissect/target/plugins/os/unix/linux/modules.py,sha256=H1S5CkpXttCVwzE2Ylz3jkvrCptN2f-fXcQ_hCB0FG0,2443
|
218
218
|
dissect/target/plugins/os/unix/linux/netstat.py,sha256=MAC4ZdeNqcKpxT2ZMh1-7rjt4Pt_WQIRy7RChr7nlPk,1649
|
219
219
|
dissect/target/plugins/os/unix/linux/proc.py,sha256=jm35fAasnNbObN2tpflwQuCfVYLDkTP2EDrzYG42ZSk,23354
|
220
|
-
dissect/target/plugins/os/unix/linux/processes.py,sha256=
|
220
|
+
dissect/target/plugins/os/unix/linux/processes.py,sha256=rvDJWAp16WAJZ91A8_GJJIj5y0U7BNnU8CW_47AueKY,1967
|
221
221
|
dissect/target/plugins/os/unix/linux/services.py,sha256=-d2y073mOXUM3XCzRgDVCRFR9eTLoVuN8FsZVewHzRg,4075
|
222
|
-
dissect/target/plugins/os/unix/linux/sockets.py,sha256=
|
222
|
+
dissect/target/plugins/os/unix/linux/sockets.py,sha256=CXstlQt0tLcVSpvi0xOXJu580O6BGUBW3lJQt20aMUw,9920
|
223
223
|
dissect/target/plugins/os/unix/linux/android/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
224
224
|
dissect/target/plugins/os/unix/linux/android/_os.py,sha256=trmESlpHdwVu7wV18RevEhh_TsVyfKPFCd5Usb5-fSU,2056
|
225
225
|
dissect/target/plugins/os/unix/linux/debian/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
@@ -245,7 +245,7 @@ dissect/target/plugins/os/unix/locate/locate.py,sha256=uXFcWAqoz_3eNWHhsGoEtkkhm
|
|
245
245
|
dissect/target/plugins/os/unix/locate/mlocate.py,sha256=DhrFgxDQF-fMZaA0WK8Z-5o9i9iDsuTHW7MHJtWwz6o,4485
|
246
246
|
dissect/target/plugins/os/unix/locate/plocate.py,sha256=Skb24ba_MVzM4nuDaZHw-ZmomIEZ3TJ7g5kHCvQViko,6545
|
247
247
|
dissect/target/plugins/os/unix/log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
248
|
-
dissect/target/plugins/os/unix/log/atop.py,sha256=
|
248
|
+
dissect/target/plugins/os/unix/log/atop.py,sha256=DdiTf-gVJJvvPbR36khU4388lxQzABaWI-95jLCGgSw,16345
|
249
249
|
dissect/target/plugins/os/unix/log/audit.py,sha256=OjorWTmCFvCI5RJq6m6WNW0Lhb-poB2VAggKOGZUHK4,3722
|
250
250
|
dissect/target/plugins/os/unix/log/auth.py,sha256=l7gCuRdvv9gL0U1N0yrR9hVsMnr4t_k4t-n-f6PrOxg,2388
|
251
251
|
dissect/target/plugins/os/unix/log/journal.py,sha256=eiNNVLmKWFj4dTQX8PNRNgKpVwzQWEHEsKyYfGUAPXQ,17376
|
@@ -254,10 +254,10 @@ dissect/target/plugins/os/unix/log/messages.py,sha256=CXA-SkMPLaCgnTQg9nzII-7tO8
|
|
254
254
|
dissect/target/plugins/os/unix/log/utmp.py,sha256=21tvzG977LqzRShV6uAoU-83WDcLUrI_Tv__2ZVi9rw,7756
|
255
255
|
dissect/target/plugins/os/windows/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
256
256
|
dissect/target/plugins/os/windows/_os.py,sha256=g5XGtruvyWx4YAhMpGZnAaIFWQqLNQpee_Ot7ROmD8w,12606
|
257
|
-
dissect/target/plugins/os/windows/activitiescache.py,sha256=
|
257
|
+
dissect/target/plugins/os/windows/activitiescache.py,sha256=Q2aILnhJ2rp2AwEbWwyBuSLjMbGqaYJTsavSbfkcFKE,6741
|
258
258
|
dissect/target/plugins/os/windows/adpolicy.py,sha256=rvsvywChfms7d2kMwXRVHZaf8zJ46WmMwYplGAYEax8,6984
|
259
259
|
dissect/target/plugins/os/windows/amcache.py,sha256=ZZNOs3bILTf0AGkDkhoatndl0j39DXkstN7oOyxJECU,27188
|
260
|
-
dissect/target/plugins/os/windows/catroot.py,sha256=
|
260
|
+
dissect/target/plugins/os/windows/catroot.py,sha256=wHW_p4M0aFonZJ2xZFIbgLbJopdCIXO9jVrGPHLsMLc,11105
|
261
261
|
dissect/target/plugins/os/windows/cim.py,sha256=jsrpu6TZpBUh7VWI9AV2Ib5bebTwsvqOwRfa5gjJd7c,3056
|
262
262
|
dissect/target/plugins/os/windows/clfs.py,sha256=begVsZ-CY97Ksh6S1g03LjyBgu8ERY2hfNDWYPj0GXI,4872
|
263
263
|
dissect/target/plugins/os/windows/credhist.py,sha256=FX_pW-tU9esdvDTSx913kf_CpGE_1jbD6bkjDb-cxHk,7069
|
@@ -265,21 +265,21 @@ dissect/target/plugins/os/windows/datetime.py,sha256=tuBOkewmbCW8sFXcYp5p82oM5RC
|
|
265
265
|
dissect/target/plugins/os/windows/defender.py,sha256=Vp_IP6YKm4igR765WvXJrHQ3RMu7FJKM3VOoR8AybV8,23737
|
266
266
|
dissect/target/plugins/os/windows/env.py,sha256=-u9F9xWy6PUbQmu5Tv_MDoVmy6YB-7CbHokIK_T3S44,13891
|
267
267
|
dissect/target/plugins/os/windows/generic.py,sha256=BSvDPfB9faU0uquMj0guw5tnR_97Nn0XAEE4k05BFSQ,22273
|
268
|
-
dissect/target/plugins/os/windows/lnk.py,sha256=
|
268
|
+
dissect/target/plugins/os/windows/lnk.py,sha256=On1k0PODYggQM1j514qFepBACCV2Z2u61Q4Ba6e3Y2c,8179
|
269
269
|
dissect/target/plugins/os/windows/locale.py,sha256=yXVdclpUqss9h8Nq7N4kg3OHwWGDfjdfiLiUZR3wqv8,2324
|
270
270
|
dissect/target/plugins/os/windows/notifications.py,sha256=64xHHueHwtJCc8RTAF70oa0RxvqfCu_DBPWRSZBnYZc,17386
|
271
|
-
dissect/target/plugins/os/windows/prefetch.py,sha256=
|
272
|
-
dissect/target/plugins/os/windows/recyclebin.py,sha256=
|
271
|
+
dissect/target/plugins/os/windows/prefetch.py,sha256=bDoJOWRp6vIHe1lf9HXNuNg5iyh5YqVw9s0P562VfKo,10460
|
272
|
+
dissect/target/plugins/os/windows/recyclebin.py,sha256=7UFjZg1NHWJyfjthhMBpQd3kGG8ZXe7H4Cu9U3QzjOs,4929
|
273
273
|
dissect/target/plugins/os/windows/registry.py,sha256=EfqUkgbzaqTuq1kIPYNG1TfvJxhJE5X-TEjV3K_xsPU,12814
|
274
|
-
dissect/target/plugins/os/windows/sam.py,sha256=
|
275
|
-
dissect/target/plugins/os/windows/services.py,sha256=
|
274
|
+
dissect/target/plugins/os/windows/sam.py,sha256=NTL6dez30i_E3R0mNmnYXMYc62DHqICWvpXy9g_2RY0,15478
|
275
|
+
dissect/target/plugins/os/windows/services.py,sha256=MoVPJ1GKpPaJrGd2DYtuHEmKqC2uOKRc5SZKB12goSs,6068
|
276
276
|
dissect/target/plugins/os/windows/sru.py,sha256=sOM7CyMkW8XIXzI75GL69WoqUrSK2X99TFIfdQR2D64,17767
|
277
277
|
dissect/target/plugins/os/windows/startupinfo.py,sha256=kl8Y7M4nVfmJ71I33VCegtbHj-ZOeEsYAdlNbgwtUOA,3406
|
278
278
|
dissect/target/plugins/os/windows/syscache.py,sha256=WBDx6rixaVnCRsJHLLN_9YWoTDbzkKGbTnk3XmHSSUM,3443
|
279
279
|
dissect/target/plugins/os/windows/tasks.py,sha256=8DRsIAuIJPaH_G18l8RYfnK_WkEqVx2xDJ1FnIc_i0g,5716
|
280
280
|
dissect/target/plugins/os/windows/thumbcache.py,sha256=23YjOjTNoE7BYITmg8s9Zs8Wih2e73BkJJEaKlfotcI,4133
|
281
281
|
dissect/target/plugins/os/windows/ual.py,sha256=TYF-R46klEa_HHb86UJd6mPrXwHlAMOUTzC0pZ8uiq0,9787
|
282
|
-
dissect/target/plugins/os/windows/wer.py,sha256=
|
282
|
+
dissect/target/plugins/os/windows/wer.py,sha256=ogecvKYxAvDXLptQj4cn0JLn1FxaXjeSuJWs4JgkoZs,8656
|
283
283
|
dissect/target/plugins/os/windows/dpapi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
284
284
|
dissect/target/plugins/os/windows/dpapi/blob.py,sha256=oFhksgx2BAaeAbpPwOM-o0Dw5MKaMLGMF6ETdxIS708,5051
|
285
285
|
dissect/target/plugins/os/windows/dpapi/crypto.py,sha256=_F1F2j1chQw-KLqfWvgL2mCkF3HSvdVnM78OZ0ph9hc,9337
|
@@ -289,30 +289,30 @@ dissect/target/plugins/os/windows/exchange/__init__.py,sha256=47DEQpj8HBSa-_TImW
|
|
289
289
|
dissect/target/plugins/os/windows/exchange/exchange.py,sha256=ofoapuDQXefIX4sTzwNboyk5RztN2JEyw1OWl5cx-wo,1564
|
290
290
|
dissect/target/plugins/os/windows/log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
291
291
|
dissect/target/plugins/os/windows/log/amcache.py,sha256=TabtjNx9Ve-u-Fn0K95A0v_SLGzn2YeNPHrcQvjVKJc,5877
|
292
|
-
dissect/target/plugins/os/windows/log/etl.py,sha256=
|
293
|
-
dissect/target/plugins/os/windows/log/evt.py,sha256=
|
294
|
-
dissect/target/plugins/os/windows/log/evtx.py,sha256=
|
295
|
-
dissect/target/plugins/os/windows/log/pfro.py,sha256=
|
296
|
-
dissect/target/plugins/os/windows/log/schedlgu.py,sha256=
|
292
|
+
dissect/target/plugins/os/windows/log/etl.py,sha256=PWMTpgKWAtYNtmQfyoos4TtgH8gnbQN19Jw1GCEeHy0,7142
|
293
|
+
dissect/target/plugins/os/windows/log/evt.py,sha256=LsM9IgidOtAeGrtztO3ng2DAPmCMVydX3bqYz12dQ_4,7080
|
294
|
+
dissect/target/plugins/os/windows/log/evtx.py,sha256=P_hQT3ZFelqhXTH_8pbnSnCwEeSxJr8hiX0F3tK-4W4,6127
|
295
|
+
dissect/target/plugins/os/windows/log/pfro.py,sha256=qqXXQ7hY8CHVdYEibmAnJrIy9Szesvr7Re19Nj_GYPg,2737
|
296
|
+
dissect/target/plugins/os/windows/log/schedlgu.py,sha256=JaP8H8eTEypWXhx2aFSR_IMam6rQiksbLKhMr_U4fz8,5570
|
297
297
|
dissect/target/plugins/os/windows/regf/7zip.py,sha256=Vc336zhS6R8W98GGlLtPJ_OR0vEP014QnBtYwbx_HUo,3217
|
298
298
|
dissect/target/plugins/os/windows/regf/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
299
|
-
dissect/target/plugins/os/windows/regf/appxdebugkeys.py,sha256=
|
299
|
+
dissect/target/plugins/os/windows/regf/appxdebugkeys.py,sha256=X8MYLcD76pIZoIWwS_DgUp6q6pi2WO7jhZeoc4uGLak,3966
|
300
300
|
dissect/target/plugins/os/windows/regf/auditpol.py,sha256=62WMlZwSzBb-99ujaeGkkOBui5qHOkvMHfACsqCmC0A,5140
|
301
|
-
dissect/target/plugins/os/windows/regf/bam.py,sha256=
|
301
|
+
dissect/target/plugins/os/windows/regf/bam.py,sha256=iELyDeA-tdT6eXMZ5HHIVSAjH6vDvmS47D2xr4iX7Y8,2084
|
302
302
|
dissect/target/plugins/os/windows/regf/cit.py,sha256=vErcoGfslyuZsaZiGbSGm6KxnJmUjobMwoy03jb6774,38244
|
303
|
-
dissect/target/plugins/os/windows/regf/clsid.py,sha256=
|
304
|
-
dissect/target/plugins/os/windows/regf/firewall.py,sha256
|
303
|
+
dissect/target/plugins/os/windows/regf/clsid.py,sha256=M121yHQgRDSGtXeShiB-RUuk_toHOFHLYwbHAP9SS8U,3632
|
304
|
+
dissect/target/plugins/os/windows/regf/firewall.py,sha256=-RUFjY4D-ua72vyvOTJyg-MpUbk9Syfo4TfgA7bV7Us,3172
|
305
305
|
dissect/target/plugins/os/windows/regf/mru.py,sha256=HYg4UnbsjvzZKS9qcqxkocUeIGQieMLXPjkjgZ1qbTY,13560
|
306
|
-
dissect/target/plugins/os/windows/regf/muicache.py,sha256
|
306
|
+
dissect/target/plugins/os/windows/regf/muicache.py,sha256=-1IYfNpFjjk4WYyFUBJGLl7ahEGeUKqlaI1QwPNnfjA,3738
|
307
307
|
dissect/target/plugins/os/windows/regf/nethist.py,sha256=QHbG9fmZNmjSVhrgqMvMo12YBaQedzeToS7ZD9eIJ28,3111
|
308
|
-
dissect/target/plugins/os/windows/regf/recentfilecache.py,sha256=
|
309
|
-
dissect/target/plugins/os/windows/regf/regf.py,sha256=
|
310
|
-
dissect/target/plugins/os/windows/regf/runkeys.py,sha256
|
308
|
+
dissect/target/plugins/os/windows/regf/recentfilecache.py,sha256=5JheHDmYc7udH-ZF7PwVTm0HfRY43diW0pmyyfHWZK0,1869
|
309
|
+
dissect/target/plugins/os/windows/regf/regf.py,sha256=D1GrljF-sV8cWIjWJ3zH7k52i1OWD8poEC_PIeZMEis,3419
|
310
|
+
dissect/target/plugins/os/windows/regf/runkeys.py,sha256=-2HcdnVytzCt1xwgAI8rHDnwk8kwLPWURumvhrGnIHU,4278
|
311
311
|
dissect/target/plugins/os/windows/regf/shellbags.py,sha256=EKBWBjxvSfxc7WFKmICZs8QUJnjhsCKesjl_NHEnSUo,25621
|
312
|
-
dissect/target/plugins/os/windows/regf/shimcache.py,sha256=
|
313
|
-
dissect/target/plugins/os/windows/regf/trusteddocs.py,sha256=
|
314
|
-
dissect/target/plugins/os/windows/regf/usb.py,sha256=
|
315
|
-
dissect/target/plugins/os/windows/regf/userassist.py,sha256=
|
312
|
+
dissect/target/plugins/os/windows/regf/shimcache.py,sha256=0THEJQtMHACAI70jrThMCrxAVgQv5XxqkRD1MY03VpE,10003
|
313
|
+
dissect/target/plugins/os/windows/regf/trusteddocs.py,sha256=3yvpBDM-Asg0rvGN2TwALGRm9DYogG6TxRau9D6FBbw,3700
|
314
|
+
dissect/target/plugins/os/windows/regf/usb.py,sha256=hR5fnqy_sint1YyWgm1-AMhGQ4MxJOH_Wz0vbYzr9p4,7213
|
315
|
+
dissect/target/plugins/os/windows/regf/userassist.py,sha256=36uI_tSGUx-lOUZ1Io_2ofHTLHzriFA3F6XMR61H0wc,5500
|
316
316
|
dissect/target/plugins/os/windows/task_helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
317
317
|
dissect/target/plugins/os/windows/task_helpers/tasks_job.py,sha256=-dCkJnyEiWG9nCK378-GswM5EXelrA_g3zDHLhSQMu0,21199
|
318
318
|
dissect/target/plugins/os/windows/task_helpers/tasks_records.py,sha256=vpCyKqLQSzI5ymD1h5P6RncLEE47YtmjDFwKA16dVZ4,4046
|
@@ -340,10 +340,10 @@ dissect/target/volumes/luks.py,sha256=OmCMsw6rCUXG1_plnLVLTpsvE1n_6WtoRUGQbpmu1z
|
|
340
340
|
dissect/target/volumes/lvm.py,sha256=wwQVR9I3G9YzmY6UxFsH2Y4MXGBcKL9aayWGCDTiWMU,2269
|
341
341
|
dissect/target/volumes/md.py,sha256=j1K1iKmspl0C_OJFc7-Q1BMWN2OCC5EVANIgVlJ_fIE,1673
|
342
342
|
dissect/target/volumes/vmfs.py,sha256=-LoUbn9WNwTtLi_4K34uV_-wDw2W5hgaqxZNj4UmqAQ,1730
|
343
|
-
dissect.target-3.18.
|
344
|
-
dissect.target-3.18.
|
345
|
-
dissect.target-3.18.
|
346
|
-
dissect.target-3.18.
|
347
|
-
dissect.target-3.18.
|
348
|
-
dissect.target-3.18.
|
349
|
-
dissect.target-3.18.
|
343
|
+
dissect.target-3.18.dev2.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
|
344
|
+
dissect.target-3.18.dev2.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
|
345
|
+
dissect.target-3.18.dev2.dist-info/METADATA,sha256=CQlktWeUyWCrkDq9WKqNFR3gxHwKVUZ-9KDPop4n6s8,11299
|
346
|
+
dissect.target-3.18.dev2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
|
347
|
+
dissect.target-3.18.dev2.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
|
348
|
+
dissect.target-3.18.dev2.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
|
349
|
+
dissect.target-3.18.dev2.dist-info/RECORD,,
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|